Fedora 22 : firefox-46.0.1-1.fc22 (2016-e2acbd739f)

new upstream version 46.0.1 - fixed focus on TWM rhbz1322626 ---- - Fixed wrong keyboard focus rhbz1322626 ---- - New upstream version 46.0 - Fixed aarch64/ppc64le build failures - Fixed missing addons/langpacks Note that Tenable Network Security has extracted the preceding description block...

CVE-2016-1596

Multiple cross-site scripting XSS vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain 1 user name, 2 tfaClientFirstName, 3 tfaClientLastName, 4 taselectedTopicContent, 5 tforgUnitName, 6...

CVE-2016-1595

LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to conduct Hibernate Query Language HQL injection attacks and obtain sensitive information via the entityName parameter...

CVE-2016-1594

Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated by obtaining sensitive information via a 1 downloadLogFiles or 2 downloadFile action...

CVE-2016-1593

Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a .. dot dot in a filename within a multipart/form-data POST request to a LiveTime.woa URL...

Deserialization of untrusted data

Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated by obtaining sensitive information via a 1 downloadLogFiles or 2 downloadFile action...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain 1 user name, 2 tfaClientFirstName, 3 tfaClientLastName, 4 taselectedTopicContent, 5 tforgUnitName, 6...

Directory traversal

Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a .. dot dot in a filename within a multipart/form-data POST request to a LiveTime.woa URL...

CVE-2016-1594

Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated by obtaining sensitive information via a 1 downloadLogFiles or 2 downloadFile action...

CVE-2016-1593

Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a .. dot dot in a filename within a multipart/form-data POST request to a LiveTime.woa URL...

CVE-2016-1594

CVE-2016-1594 affects Micro Focus (Novell) Service Desk before 7.2. Remote authenticated users can read arbitrary attachments via LiveTime.woa with downloadLogFiles or downloadFile; impact is information disclosure. Affected product versions and root cause are described, but no explicit patch/fix...

CVE-2016-1593

CVE-2016-1593 affects Micro Focus/Novell Service Desk prior to 7.2. A directory traversal flaw in the import users feature allows a remote authenticated administrator to upload and execute arbitrary JSP files via a .. (dot dot) in a filename in a multipart/form-data POST to LiveTime.woa, enabling...

CVE-2016-1596

Multiple cross-site scripting XSS vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain 1 user name, 2 tfaClientFirstName, 3 tfaClientLastName, 4 taselectedTopicContent, 5 tforgUnitName, 6...

CVE-2016-1595

The CVE-2016-1595 issue affects Micro Focus/Novell Service Desk prior to 7.2, specifically the DownloadAction/downloadFile path in LiveTime/WebObjects/LiveTime.woa/wa. It enables remote authenticated users to perform HQL injection via the entityName parameter, leading to potential information dis...

CVE-2016-1595

LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to conduct Hibernate Query Language HQL injection attacks and obtain sensitive information via the entityName parameter...

CVE-2016-1596

CVE-2016-1596 affects Micro Focus/Novell Service Desk prior to 7.2, where multiple XSS flaws exist. Remote authenticated users can inject arbitrary web script or HTML via (1) user name, (2) tf_aClientFirstName, (3) tf_aClientLastName, (4) ta_selectedTopicContent, (5) tf_orgUnitName, (6) tf_aManuf...

CVE-2016-1657

The WebContentsImpl::FocusLocationBarByDefault function in content/browser/webcontents/webcontentsimpl.cc in Google Chrome before 50.0.2661.75 mishandles focus for certain about:blank pages, which allows remote attackers to spoof the address bar via a crafted URL...

UBUNTU-CVE-2016-1657

The WebContentsImpl::FocusLocationBarByDefault function in content/browser/webcontents/webcontentsimpl.cc in Google Chrome before 50.0.2661.75 mishandles focus for certain about:blank pages, which allows remote attackers to spoof the address bar via a crafted URL...

Design/Logic Flaw

The WebContentsImpl::FocusLocationBarByDefault function in content/browser/webcontents/webcontentsimpl.cc in Google Chrome before 50.0.2661.75 mishandles focus for certain about:blank pages, which allows remote attackers to spoof the address bar via a crafted URL...

CVE-2016-1657

The WebContentsImpl::FocusLocationBarByDefault function in content/browser/webcontents/webcontentsimpl.cc in Google Chrome before 50.0.2661.75 mishandles focus for certain about:blank pages, which allows remote attackers to spoof the address bar via a crafted URL...